dcathem2.bin
- SHA256 6152a26e5987544f93d3464cc1b07e03536a83c8e505c6ce5ddba541114d8dce
-
Detects DonutLoader
General
- Target dcathem2.bin
- Size 586KB
- Sample261030-ws12lsfs3j
- SHA256 6152a26e5987544f93d3464cc1b07e03536a83c8e505c6ce5ddba541114d8dce
- MD5 6ade8b1ef3df3d2ed4701336278445d4
- SHA1 8e147f15b8fd39476cf7db0e357d9f20c97e8f94
- SHA512 586321e0b72abb1f3901e9e0e2a098b6503443252b9950df9ad2cdb38ec292c12f3c19a31ae3e03ddcb34d14c5e97916b694f13d18c12edd38e670ed1ead58e1
- SSDEEP 12288:3dA6OasZxCE9cBjcs/dGg4t6dTGvnZ+SWKMza5qQtFaJPbgIQI6JB:tA6TsZk0chXd7lo+RM5ZFaJPbg/X
- TLSH T170D42355277103DDD5314A53BC21E83EE5B3798B90ACBD8BBBA85CE12D13E629B0C4B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule sample family_donutloader
File Explorer
-
dcathem2.bin586KB